An administrator wants to create a policy-based IPsec VPN tunnel between two FortiGate devices. Which configuration steps must be performed on both units to support this scenario? (Choose three.)

Phase 2 parameters define the security associations for the data tunnel, including encryption and authentication, which must precisely match on both VPN endpoints to successfully establish and secure the data path.

Policy-based IPsec VPNs for site-to-site connections typically use tunnel mode encapsulation to encrypt the entire original IP packet, whereas transport mode is generally used for host-to-host or client-specific scenarios.

For policy-based IPsec VPNs, firewall policies define the 'interesting traffic' that triggers the tunnel and have an action like 'ACCEPT'; the action 'IPsec' is specific to route-based VPNs, where it directs traffic to a virtual tunnel interface.

A static route must be configured on both FortiGates to direct traffic destined for the remote network specifically over the established IPsec tunnel, ensuring proper traffic flow through the VPN.

Phase 1 parameters establish the secure control channel (IKE negotiation) and must match on both units; for policy-based VPNs, it is crucial that IPsec interface mode is not enabled, as this setting is exclusive to route-based VPNs.